🔎 Reverse Image Search
Image search techniques made simple: upload a photo or paste a URL and search 6 engines at once. 100% free, nothing stored.
🔒 Your image is never stored on our servers longer than 24 hours and is never shared.
You have probably seen a photo online and wondered whether it is real, AI-generated or edited — and wished there were a label you could trust. There is, when the image carries one. To check Content Credentials (C2PA), open the free official verifier at contentcredentials.org/verify, upload the original image file or paste its URL, and read the signed manifest it returns, which names the maker, the tools used and whether AI was involved. This guide explains how to check content credentials C2PA records on any photo, what each part of the result means, and what to do when the check comes back blank.
In 2026, this check matters more than ever. AI image tools now produce pictures that look exactly like photographs, and social feeds are full of images whose origins nobody can explain. Content Credentials are the industry’s agreed answer: a tamper-evident label that travels with the file. They are not perfect, and they are not on every photo yet, but when they are present they give you something no guesswork can — a signed, checkable record of where a picture came from.
What Are Content Credentials (C2PA)?
Content Credentials are a cryptographically signed record of a photo’s history — who made it, what tools touched it and whether AI was involved — attached to the file under the open C2PA standard. The record is called a manifest, and each statement inside it is called an assertion.
The standard comes from the Coalition for Content Provenance and Authenticity, usually shortened to C2PA. The coalition was announced in February 2021 by Adobe, Arm, the BBC, Intel, Microsoft and Truepic, and it writes the open technical standard that publishers, creators and consumers use to establish the origin of digital content. The C2PA itself describes Content Credentials as a “nutrition label” for digital content: a quick, standardised look at a file’s history that anyone can read at any time. As of October 2026, the C2PA steering committee includes Adobe, Amazon, the BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic.
Two names often appear side by side, so it helps to separate them. C2PA is the coalition and the standard it writes. The Content Authenticity Initiative, founded by Adobe in 2019, builds the open-source tools that implement the standard and calls the result Content Credentials. In everyday use, people treat the two terms as the same thing, and for checking a photo, the difference does not matter — what matters is the signed record itself.
Version 2.4 of the C2PA specification, published in April 2026, added dedicated fields for recording AI use and made it possible to embed provenance in text such as HTML documents and Markdown. The standard keeps moving because the problem keeps growing: every month, more cameras, phones and AI tools start signing what they produce.
Who actually adds Content Credentials to a photo today?
- AI generators. OpenAI adds them to images generated by ChatGPT and through its API. Google adds them to images from its Imagen models in supported products, and Adobe Firefly adds them to every image it generates.
- Editing apps. Adobe Photoshop, Lightroom and Firefly can attach Content Credentials when you export, and each edit can add its own entry to the record.
- Cameras. Leica says its M11-P, announced in October 2023, was the first camera to attach Content Credentials at the moment of capture. Sony’s Alpha 1, Alpha 9 III and Alpha 7 IV can add C2PA signatures through firmware updates, and Nikon offers the same on the Z6 III through its Authenticity Service.
- Phones. Google says the Pixel 10 is the first phone whose native camera app adds Content Credentials to every photo it takes, and Samsung says the Galaxy S25 series supports Content Credentials for content created and edited with Galaxy AI.
- Platforms. LinkedIn and Behance show the small “cr” icon on content that carries credentials. TikTok says it has labelled more than 3 billion items as AI-generated, using Content Credentials alongside invisible watermarks and its own labelling tools.
The important point is that credentials are added by the tool that creates or edits the file. A photo only carries them if something in its history chose to sign it. That is why the check below is quick — and why a blank result needs careful interpretation, which this guide covers later.
How to Check Content Credentials (C2PA) in Under a Minute
You do not need to install any software, create an account or pay anything. The official verifier runs entirely in the browser, on desktop and on mobile.
- Get the original file. Save or download the actual image file. A screenshot, or a copy downloaded from most social apps, usually has no credentials left, because re-encoding strips them. If you only have a screenshot, check that too — but expect a blank result, and read the section below on what to do next.
- Open the official verifier. Go to the official Content Credentials Verify tool. It is run by the Content Authenticity Initiative and needs no account. The tool does not store the image you check.
- Drop the image in. Drag the file onto the page, choose it from your device, or paste a direct image URL. The verifier reads the manifest inside the file and validates its signature.
- Read the result. If a valid manifest is present, you will see who signed it, when it was signed, which tools were used, the edit history and any AI-generation flag. If the file has no manifest, the verifier simply says no Content Credentials were found.
- Check the details, not just the headline. Open the full history view. An image can be genuinely photographed and then AI-edited, or AI-generated and then cropped in a normal editor — the edit chain tells you which, and the order matters.
There are other ways to see the same information. Adobe offers a free Content Authenticity extension for Chrome and other Chromium-based browsers: a small “cr” pin appears on images that carry credentials, and selecting it shows a summary, with an Inspect option for the full record. Inside Adobe apps, images with valid credentials show the same pin and open a full credentials panel. Google’s About this image feature can show whether an image was captured with a camera or generated with AI when those details are available, drawing on C2PA metadata — Google said in September 2024 that this feature would use C2PA data. The Gemini app can also check Content Credentials in image, video and audio files from products on the C2PA Conforming Products List, for version 2.2 of the standard and later.
The verifier accepts far more than still photos: the Content Authenticity Initiative’s Verify site handles JPEG, PNG, WebP, AVIF, HEIC, DNG and TIFF images, plus video, audio and PDF files, and shows the full history, including earlier versions of an image when they are recorded. For a photo check, though, the five steps above are all you need.
Worked Example: What a Real ChatGPT Image’s Credentials Actually Show
Steps are easy to describe; a real result is more useful. In October 2026, the team at uncrop.si checked an image generated in ChatGPT, reading it with their checker, which verifies the signature on the device against the C2PA trust lists. Here is exactly what the manifest said.
| Field | What the record said |
|---|---|
| Signed by | OpenAI OpCo, LLC, with a certificate from a C2PA certificate authority |
| Written by | OpenAI Media Service API |
| How it was made | Created with gpt-image, OpenAI’s image model; digital source type “trained algorithmic media”, meaning generative AI |
| Later steps | Converted, and an invisible watermark added to the pixels |
| When | The signing time, from OpenAI’s time-stamping service |
| Not included | The prompt, and no mention of ChatGPT by name |
Walk through what that tells you. First, the signer is OpenAI itself, not an anonymous uploader, and the certificate chains back to a C2PA certificate authority — that is what makes the record checkable rather than a claim anyone could type. Second, the record names the model, gpt-image, and states plainly that the image is generative AI, through the “trained algorithmic media” source type. Third, it records the later steps honestly: the file was converted and an invisible watermark was added to the pixels, which is the companion to the manifest — the watermark survives steps that strip the manifest, such as screenshots.
Just as useful is what the record does not say. It does not contain the prompt that produced the image, so you cannot see what was asked for. And it does not name ChatGPT: the record names OpenAI’s model and media service, so it shows that OpenAI made the picture, not which OpenAI app was used. That distinction matters if you are trying to trace an image back to a specific account or conversation — the manifest will not take you that far.
Now try the same image a second way. Take a screenshot of that ChatGPT picture and drop the screenshot into the verifier. The result is “no Content Credentials found”. The C2PA’s own guidance warns that screenshots, and exporting through tools that strip metadata, remove embedded Content Credentials — the screenshot is a new file, and the new file was never signed. This is the single most common reason a real, signed image seems to have no credentials at all, and it is why step one of the method above insists on the original file.
There is one partial rescue. Adobe’s Content Authenticity app offers a “Search for possible matches” feature that can recover credentials stored in Adobe’s Content Credentials cloud, even from a screenshot — but only if the credentials were stored in that cloud in the first place. If they were only embedded in the file and a site stripped them on upload, they may not be recoverable this way. Outcomes vary by platform and by how the image was shared, so treat a recovered cloud record as a bonus, not something to rely on.
You can repeat this worked example yourself in two minutes. Generate any image in ChatGPT, download the original file it gives you, and drop it into the official verifier. You should see the same pattern: OpenAI as signer, gpt-image as the maker, and a clear AI-generation statement. The exact fields may vary as OpenAI updates its tools, but the shape of the answer — who, what tool, whether AI — stays the same.
How Do I Read the Result: Valid, Trusted or Invalid?
The verifier does more than say “found” or “not found”. The C2PA specification grades a record in steps, and understanding the grades stops you over-reading a good result or dismissing a useful one.
- Valid. The record is intact, the file has not changed since it was signed, and the signature checks out with a certificate that was valid and not revoked at the time. Valid is the baseline: the history the file claims has not been tampered with.
- Trusted. Valid, and the signer’s certificate also leads back to a trust list. Checkers must include the official C2PA Trust List, which comes from the C2PA Conformance Program that launched in 2025. The older Interim Trust List was frozen on 1 January 2026, and content signed under it while its certificate was valid still counts. Every trusted record is also valid, but not every valid record is trusted.
- Invalid. Something does not match, usually because the image was changed after it was signed. An invalid result is a meaningful red flag: the file was altered after the signature was applied, so the recorded history can no longer be relied on.
That middle grade causes the most confusion. A genuine camera photo can come out as valid rather than trusted. Sony, for example, provides a default signing certificate free of charge, but says it does not guarantee the validity of the C2PA signature and recommends a certificate equivalent to one on a trust list instead. A photo signed with a certificate that is on no trust list may be perfectly real, but a checker cannot confirm who signed it. So treat “valid but not trusted” as “history intact, signer unconfirmed” — useful, but not the strongest result.
What should you do with each result? A trusted record with a named, reputable signer is strong evidence about the file’s history — act on it. A valid record is good evidence that the file is unchanged since signing, but check the signer before you quote it. An invalid record means something changed after signing: do not trust the history, and run the other checks in this guide before you use or share the image. And a missing record means nothing on its own — see the limits section next.
What Content Credentials Cannot Tell You
Content Credentials are the best provenance tool the industry has agreed on, but they are not a lie detector. Overtrusting them is its own mistake, and the competitor guides that skip this part do their readers a disservice.
- They are optional. A file only carries credentials if the creating tool added them. Plenty of real photos and plenty of AI images have none at all, so most of the images you meet online will return a blank result.
- They can be stripped. Screenshotting an image, re-saving it, or uploading it to a platform that re-encodes files can remove the manifest — the same re-encoding that drops EXIF data often drops C2PA too.
- Absence is not proof. No credentials does not mean “real” and does not mean “fake”. It just means the label is not there.
- Valid does not mean true. A valid credential shows that the record is intact and the file has not changed since it was signed, not that the scene is true. The C2PA’s own explainer says provenance information alone cannot tell you whether content is true, accurate or factual. A real photo of a staged scene, or a real camera photo with a misleading caption, will still verify cleanly.
- They do not name the person behind the image. Unless the creator chose to attach their name, the record names tools and companies, not individuals — so it cannot settle who actually pressed the button.
- They say nothing about the caption. A signed photo can still be shared with a false claim about where or when it was taken. Provenance covers the file, not the story told with it.
There is also a regulatory push worth knowing about. The EU AI Act requires AI-generated and AI-manipulated content to be marked in a machine-readable way, and C2PA is one of the leading standards being adopted to meet that requirement. That is a major reason adoption is accelerating in 2026, though it does not yet mean every AI image you meet will be labelled. At Google I/O 2026, Google announced that C2PA verification and SynthID detection are coming natively to Google Search and Chrome, which would put this check in front of far more people without them needing to visit a verifier at all.
Content Credentials vs EXIF, SynthID and AI Detectors
Content Credentials are one of four tools people reach for when they ask whether a photo is real. They answer different questions, and they work best together.
| Check | What it records | Who can check it | Survives a screenshot? |
|---|---|---|---|
| Content Credentials (C2PA) | Signed history: maker, tools, edits, AI use | Anyone, with a free verifier | No |
| EXIF metadata | Camera, date, settings, sometimes GPS | Anyone, with a metadata viewer | No |
| SynthID | Invisible pixel watermark from Google AI tools | Only Google, via Gemini | Built to survive many edits |
| AI detector | Statistical guess that pixels look AI-made | Anyone, with a detector tool | Yes, it reads the pixels |
EXIF is the camera’s own record: capture date, camera model, exposure settings and sometimes location. It is useful, but it is unsigned — anyone can edit it — and platforms routinely strip it on upload. Read our guide to image metadata to see what EXIF can and cannot prove, and how it compares with a signed C2PA record.
SynthID is Google’s invisible watermark, embedded in the pixels of images from its AI tools. Google says it has watermarked more than 100 billion images and videos with SynthID, and that SynthID verification through the Gemini app has been used 50 million times. The watermark is built to survive screenshots and edits that would strip a manifest, which is exactly why Google and OpenAI pair it with Content Credentials. The catch is that only Google can check it, through Gemini — you cannot verify SynthID yourself with an independent tool.
AI detectors work differently again: they analyse the pixels and give a statistical opinion about whether an image looks AI-generated. They need no metadata at all, which makes them the only option when credentials and EXIF are both gone — but they guess, and they can be wrong in both directions. Our guide on how to tell if an image is AI-generated explains how to use them without being misled by a single score.
The practical rule is simple. Use Content Credentials first when they exist, because a valid signature is strong evidence. When they are absent or stripped, fall back to EXIF and forensic analysis, and use an AI detector as a second opinion rather than a verdict. No single check is definitive, but together they give you a confident, defensible read on a photo.
What to Do When a Photo Has No Credentials
A blank result is the most common outcome, and it is where most guides stop. Do not stop there — run this short routine instead.
- Run a reverse image search. A reverse image search finds where else the photo has appeared, which often reveals its original context, an earlier date or a different caption. If the same image appears on a stock site, a news article from two years ago or a dozen scam profiles, that tells you more than a missing manifest ever could.
- Check Google About this image. It shows a photo’s history and where it has appeared, and can flag AI generation from C2PA data when available. It is a fast second opinion that uses Google’s own index rather than the file in front of you.
- Read the metadata. Open the original file in a metadata viewer and look for camera details, dates and editing software. Unsigned EXIF is weaker evidence than a signed manifest, but a camera model and a plausible date still narrow the story down.
- Look at the image itself. Our guide on how to tell if a photo is real walks through the visual checks — hands, text, reflections, lighting and edges — that catch what metadata cannot.
- Ask what the image is being used to prove. A photo offered as evidence for a surprising claim deserves more checks than a photo used to illustrate a recipe. Match the effort to the stakes, and if the image still cannot be verified, say so rather than sharing it as fact.
One more habit is worth building. When you find a photo with valid, trusted credentials, save the original file rather than a screenshot. The original keeps its signed history; the screenshot does not. If you ever need to prove where that image came from — to a reader, a client or a platform’s report form — the original file is the evidence, and the screenshot is just a picture of it.
FAQs
Does a photo without Content Credentials mean it is fake?
No. Content Credentials only exist when the tool that made or edited the photo added them, and most photos online still carry none. A missing credential is a neutral result, not evidence of fakery, so treat it as the start of your checks rather than a verdict and cross-check the image with a reverse image search and its metadata.
Can Content Credentials be faked?
Not easily, and not without leaving a trace. The record is cryptographically signed, so changing the image or the record after signing breaks the signature and the verifier reports the mismatch. A forger would need the signer’s private key to create a convincing fake, which is why a trusted credential carries real weight.
Do ChatGPT images have Content Credentials?
Yes. OpenAI has added Content Credentials to images generated by ChatGPT since early 2024, and its May 2026 update extended them to every image ChatGPT generates, including on the free tier. The record names OpenAI as the signer and the gpt-image model as the maker, though it does not include your prompt.
Can I check Content Credentials on my phone?
Yes. The official verifier works in any modern mobile browser, so you can upload the original file from your phone or paste the image URL. On a Pixel 10, photos signed by the camera app can also show their credentials in Google Photos, and the Content Authenticity browser extension works on desktop browsers.
Provenance is only one layer — for the full picture, see our best AI image detector tools compared, which tests Hive, AI or Not, SynthID and C2PA Verify side by side.
If the photo is your own work, you can also check if your work was used to train AI.
